CVE-2023-39978 — Missing Release of Memory after Effective Lifetime in Imagemagick

CWE-401 — Missing Release of Memory after Effective Lifetime5 documents5 sources
Severity
3.3LOWNVD
EPSS
0.0%
top 89.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
ImagemagickFedoraproject FedoraDebian Imagemagick
Timeline
PublishedAug 8

Description

ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4

Affected Packages2 packages

▶NVDimagemagick/imagemagick< 6.9.12-91

Also affects: Fedora 37

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-j6x7-7g72-8ww2: ImageMagick before 6↗2023-08-08
▶
OSV
CVE-2023-39978: ImageMagick before 6↗2023-08-08
▶

📋Vendor Advisories

2
Red Hat
ImageMagick: Memory leak in Magick::Draw↗2023-08-08
▶
Debian
CVE-2023-39978: imagemagick - ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memo...↗2023
▶